CVE-2025-42901 Overview
CVE-2025-42901 is a stored cross-site scripting (XSS) vulnerability in the BAPI Explorer functionality of SAP Application Server for ABAP. An authenticated attacker can persist malicious JavaScript payloads that execute in a victim user's browser when the affected BAPI Explorer functionality is accessed. The flaw is categorized under [CWE-94] (Improper Control of Generation of Code) and impacts confidentiality and integrity while leaving availability unaffected. SAP addressed the issue in the October 2025 SAP Security Patch Day release.
Critical Impact
Authenticated attackers can inject persistent JavaScript that executes in the context of other SAP users' sessions, enabling session data theft, unauthorized actions in the SAP GUI, and lateral movement within the ABAP environment.
Affected Products
- SAP Application Server for ABAP (BAPI Explorer component)
- SAP NetWeaver ABAP-based systems exposing BAPI Explorer
- Refer to SAP Note #3652788 for the exact patched versions
Discovery Timeline
- 2025-10-14 - CVE-2025-42901 published to the National Vulnerability Database
- 2025-10-14 - SAP releases fix via SAP Security Patch Day Announcement
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-42901
Vulnerability Analysis
The vulnerability is a stored cross-site scripting flaw in the BAPI Explorer, a development tool used to browse and test Business Application Programming Interfaces (BAPIs) within SAP ABAP systems. The BAPI Explorer stores user-supplied input without adequate output encoding or input sanitization. When another authenticated user later accesses the affected functionality, the browser renders the attacker's payload as executable JavaScript within the SAP application origin.
Because the payload executes in the victim's authenticated session, attackers can read data the victim is authorized to view and issue requests on the victim's behalf. Exploitation requires network access to the SAP Application Server and valid low-privilege credentials, with no user interaction beyond the victim opening the affected BAPI Explorer view.
Root Cause
The root cause is improper neutralization of script content in fields rendered by the BAPI Explorer interface. Input that should be treated as inert text is instead reflected into the HTML response without contextual escaping, allowing script tags and event handlers to execute in the DOM. This aligns with the [CWE-94] classification for improper control of code generation.
Attack Vector
An authenticated attacker submits a crafted payload through a BAPI Explorer input field that the server persists. When any user, including higher-privileged developers or administrators, navigates to the affected BAPI Explorer view, the stored payload executes in their browser. The attacker can then exfiltrate SAP session cookies, invoke ABAP function modules under the victim's identity, or pivot to further internal targets.
No verified public exploitation code is available. Refer to SAP Note #3652788 for vendor-supplied technical details.
Detection Methods for CVE-2025-42901
Indicators of Compromise
- Unexpected <script> tags, javascript: URIs, or on* event handler attributes stored in BAPI Explorer metadata fields
- Outbound HTTP requests from user browsers to unfamiliar domains immediately after loading BAPI Explorer pages
- Anomalous SAP function module invocations originating from developer or administrator sessions shortly after BAPI Explorer access
Detection Strategies
- Review SAP Security Audit Log (transaction SM20) for unusual write activity to BAPI Explorer objects by low-privilege accounts
- Inspect HTTP responses from ABAP web endpoints for unescaped script content in BAPI-related pages
- Correlate authentication events with subsequent privileged actions to identify session hijacking indicative of successful XSS exploitation
Monitoring Recommendations
- Enable and forward SAP ICM and Security Audit Logs to a centralized SIEM for behavioral analysis
- Monitor for creation or modification of BAPI Explorer entries by users lacking a legitimate development role
- Alert on browser-side content security policy (CSP) violations reported by SAP web frontends
How to Mitigate CVE-2025-42901
Immediate Actions Required
- Apply the SAP-provided patch referenced in SAP Note #3652788 to all affected ABAP systems
- Audit accounts with access to BAPI Explorer and revoke privileges from users who do not require them
- Review stored BAPI Explorer content for previously injected script payloads and remove malicious entries
Patch Information
SAP released the fix as part of the October 2025 SAP Security Patch Day. Administrators should download and apply the correction instructions in SAP Note #3652788 and validate the update against the guidance in the SAP Security Patch Day Announcement.
Workarounds
- Restrict access to BAPI Explorer transactions and services to a minimal set of trusted developer accounts until patching is complete
- Deploy a strict Content Security Policy on SAP web dispatcher responses to limit inline script execution
- Disable or block network access to the BAPI Explorer endpoint at the SAP Web Dispatcher or reverse proxy layer if the functionality is not required
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
